# The Prairie Schooner — UDM Pro LAN/DHCP Plan (SonicWall+USG replacement)

Built 2026-07-14 from ScreenConnect inventory (authoritative, per Howard) cross-checked
against the 2026-07-14 onsite ping sweep. Goal: every device keeps its current IP.

## LAN settings (UDM Pro Network app)

- Network: 192.168.1.0/24, gateway **192.168.1.1** (Pro takes the SonicWall's IP)
- Domain name: `tps.local`
- DHCP pool (superset of today's clients): **192.168.1.100 – 192.168.1.199**
  - Statics .125 and .135 are OUTSIDE reservations but INSIDE this range — see exclusions below.
- DHCP DNS handed to clients: **192.168.1.125, 192.168.1.135** for the swap (SAME primary as
  the SonicWall hands today — the gateway swap must change nothing observable). AFTER the
  network is proven, flip the order to .135 first on the Pro (the migration unblock — now a
  10-second change we control).
- Disable content filtering / DNS Shield / ad-block (DCs do DNS)

## Fixed-IP reservations (MAC -> IP)

| IP | MAC | Device | Source |
|---|---|---|---|
| 192.168.1.130 | C0:25:A5:D5:2D:17 | TPS-JAYMI (Win11, OptiPlex 5090, SN 4FMLGR3) | SC + sweep |
| 192.168.1.139 | C0:25:A5:D5:2D:8B | TPS-TINA (Win11, OptiPlex 5090, SN HBMLGR3) | SC + sweep |
| 192.168.1.149 | 00:BE:43:D3:72:BD | MEL-PC (Win10, OptiPlex 5090, SN 5DMLGR3, user erin) | SC + sweep |
| 192.168.1.141 | 80:5E:C0:1A:19:3D | Yealink desk phone | sweep + TLS/HTTP probe 2026-07-14 |
| 192.168.1.142 | 80:5E:C0:49:AA:06 | Yealink desk phone (cert CN 805ec049aa06) | sweep + TLS/HTTP probe |
| 192.168.1.145 | E4:24:6C:2C:07:98 | Dahua NVR (camera recorder) | sweep + TLS/HTTP probe |
| 192.168.1.146 | 80:5E:C0:1A:14:ED | Yealink desk phone | sweep + TLS/HTTP probe |

## Static hosts (no reservation — configured on the host; keep OUT of active leases)

| IP | MAC | Device |
|---|---|---|
| 192.168.1.125 + .120 | 6C:0B:84:A5:D7:57 | TPS-SERVER (old DC, Server 2016, TS140). SC reports .120 as the NIC primary; .120 and .125 both bound to this NIC. |
| 192.168.1.135 | 5C:ED:8C:EB:26:A6 | TPS-SVR (new DC, Server 2019, MicroServer Gen10+ v2) |

UniFi note: if the app complains about statics inside the pool, either create dummy fixed-IP
entries for .125/.135 with their MACs, or shrink the pool to .100–.119 + .126–.134 equivalent —
simplest is pool .140–.199 plus the reservations above; any layout is fine as long as .120,
.125, .135 can never be leased to another MAC.

## Cutover sequence

1. Enter LAN config on the Pro with its LAN port ISOLATED (nothing but a laptop).
2. Verify reservations + DNS order in the running config.
3. Pull SonicWall (.1) and USG; patch the office switch into the Pro's LAN.
4. `ipconfig /renew` on a workstation -> expect same IP, DNS = .135, .125, internet up.
5. Public egress changes from 184.176.147.183 to the Cox-dynamic WAN (184.191.143.52 at
   adoption) — acceptable, no inbound services.
6. Then resume the paused AD migration (FSMO, CA, QB DBSM, demote old DC).

## As-built 2026-07-15

- Swap completed and verified onsite (see cutover-runbook.md AS-BUILT section).
- The device previously listed as the "USG" (.136) is actually a **UniFi USW-Lite-16-PoE**
  switch — no separate USG ever existed. Kept in service: adopted into the Pro's console,
  uplinked to the Pro's LAN port; PoE-powers the 3x Yealink phones. Give it a fixed IP
  (Devices -> switch -> Settings -> Network) once its DHCP address is noted.
- Workstation fixed IPs set in UniFi 2026-07-15; security toggles confirmed OFF.

## Open items

- ~~Identify the 4 unknown LAN devices~~ DONE 2026-07-14: 3x Yealink desk phones
  (.141/.142/.146 — the "Ubiquiti OUI" read was wrong, 80:5E:C0 is Yealink) + 1x Dahua NVR
  (.145). Both are outbound-only (hosted SIP / Dahua P2P) — no inbound rules needed; the
  public-IP change at cutover stays a non-issue. Post-flip check: phones re-register, NVR
  remote view works.
- USG's real role/wiring still unconfirmed (previously seen at .136 — not answering the sweep).
  Physically trace it at flip time; it is being removed either way.
- SonicWall DHCP scope unknown (admin password invalid) — superset pool above covers it.